From 5cabf6d4f9ba523f49dd6de33812840ef2cf51b0 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Mon, 29 Jul 2013 11:16:12 +0200
Subject: [PATCH] Bug 898047 - Fix Ion to set the Folded flag on arguments MIR
 when optimizing fun.apply(x, arguments). r=bhackett

---
 js/src/ion/IonBuilder.cpp              |  2 ++
 js/src/jit-test/tests/ion/bug898047.js | 23 +++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 js/src/jit-test/tests/ion/bug898047.js

diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index 66580c49f3b..21169f84011 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -4666,6 +4666,7 @@ IonBuilder::jsop_funapplyarguments(uint32_t argc)
 
         // Vp
         MPassArg *passVp = current->pop()->toPassArg();
+        passVp->getArgument()->setFoldedUnchecked();
         passVp->replaceAllUsesWith(passVp->getArgument());
         passVp->block()->discard(passVp);
 
@@ -4705,6 +4706,7 @@ IonBuilder::jsop_funapplyarguments(uint32_t argc)
 
     // Vp
     MPassArg *passVp = current->pop()->toPassArg();
+    passVp->getArgument()->setFoldedUnchecked();
     passVp->replaceAllUsesWith(passVp->getArgument());
     passVp->block()->discard(passVp);
 
diff --git a/js/src/jit-test/tests/ion/bug898047.js b/js/src/jit-test/tests/ion/bug898047.js
new file mode 100644
index 00000000000..ff47079e1c7
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug898047.js
@@ -0,0 +1,23 @@
+function g(aa) {
+    assertEq(aa, 123);
+}
+function f(x, yy) {
+    if (yy < 0) {
+	for (var j=0; j<100; j++) {}
+    }
+    var o = yy < 2000 ? o1 : o2;
+    o.fun.apply(22, arguments);
+}
+
+function test() {
+    o1 = {};
+    o1.fun = g;
+
+    o2 = {};
+    o2.x = 3;
+    o2.fun = g;
+
+    for (var i=0; i<3000; i++)
+	f(123, i);
+}
+test();